Getting Data In

Error when routing data to index and sourcetype based upon incoming hosts: "Undocumented key used in transforms.conf"

a212830
Champion

Hi,

I'm trying to route data to different indexes and sourcetypes based upon hosts coming, but getting errors, and uncertain why. The errors are:

Undocumented key used in transforms.conf; stanza='ise2_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='ise_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='pep_index_override' setting='DEST_KEY' key='MetaData:Index'
Undocumented key used in transforms.conf; stanza='pf_index_override' setting='DEST_KEY' key='MetaData:Index'

Inputs (udp feed)
[udp://10515]
connection_host = dns
index = main
sourcetype = temp10515_syslog

Props.conf:
[temp10515_syslog]
ANNOTATE_PUNCT = false
KV_MODE = AUTO
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRANSFORM-10515sourcetype_and_index_override = ise2_index_override, ise2_sourcetype_override, pf_index_override, pf_sourcetype_override

Transforms.conf:
[ise2_sourcetype_override]
DEST_KEY = MetaData:Sourcetype
REGEX = (%ISE)
FORMAT = sourcetype::cisco:ise:syslog

[ise2_index_override]
DEST_KEY = MetaData:Index
REGEX = (%ISE)
FORMAT = network90

[pf_sourcetype_override]
DEST_KEY = MetaData:Sourcetype
REGEX = (%PF)
FORMAT = sourcetype::netscreen_syslog

[pf_index_override]
DEST_KEY = MetaData:Index
REGEX = (%PF)
FORMAT = network
0 Karma

damien_chillet
Builder

DEST_KEY for index should be

_MetaData:Index : The index where the event should be stored. (Notice the underscore prefix)

(http://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Transformsconf)

woodcock
Esteemed Legend

Yes, this one is special.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

@damien_chillet FTW! Accept this answer @a212830 and make it rain karma!

Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...